Availability of BigFix Compliance Analytics 2.0 Patch 1

Release Announcements Compliance (Release Announcements)
1

HCL BigFix is pleased to announce the release of BigFix Compliance Analytics version 2.0 Patch 1
Product: BigFix Compliance

Title: Availability of BigFix Compliance Analytics version 2.0 Patch 1

Published site: SCM Reporting, version 131

New features and updates:

BigFix Compliance Analytics version 2.0 Patch 1 includes the following new features, enhancements and fixes.

  • Additional platform / application support including Mac OS, CentOS and Windows ESU sites for patch / vulnerability reporting
  • BigFix Compliance Analytics versions 1.10 and 2.0.0 will dynamically add CentOS and Windows ESU. Only 2.0.1 and later will support Mac OS.
  • Compliance Analytics patch / vulnerability reporting now supports the following platforms: Windows OS, Windows ESU (applications), RHEL, CentOS, MacOS.
  • Support for custom patch sites
  • Custom sites can be specified as containing patches for including in Patch and Vulnerability reports
  • Enhancement for supersedence handling in patch / vulnerability reporting when the EnableSupersededEval setting is used by Windows clients
  • Improvements to patch and vulnerability reporting logic:
  • “% Remediated” no longer includes “never relevant” in the calculation to improve accuracy.
  • “Days to Patch” is now calculated based on when endpoints are first relevant instead of patch release date.
  • Improved accuracy of vulnerability reporting in certain situations involving superseded content
  • Ability to schedule reports with XLSX report option
  • Dependencies, middleware and libraries updated to address security vulnerabilities
    • jQuery has backports of security fixes applied to address vulnerabilities: SNYK-JS-JQUERY-565129, SNYK-JS-JQUERY-567880, CVE-2020-11022, CVE-2020-11023, SNYK-JS-JQUERY-174006, CVE-2019-11358, CVE-2019-5428
  • Various bug fixes, security fixes, and performance improvements

Actions to take:

  1. To take advantage of the new features and fixes, upgrade BigFix Compliance Analytics to version 2.0.1.

For first time installation:

  1. In the License Overview Dashboard in the BigFix console (Bigfix Management domain), enable the SCM Reporting site.
  2. In the Security Configuration domain in the console, open the Configuration Management navigation tree.
  3. Select the Fixlet named BigFix Compliance Server 2.0 - First-time Install Fixlet under the BigFix Compliance Install/Upgrade menu tree node.
  4. Follow the Fixlet instructions and take the associated action to install your BigFix Compliance deployment.

For upgrade installation: Refer to the prescribed upgrade steps for the BigFix Compliance version that you are using.

IMPORTANT: Before you start any upgrade process, perform a server and database backup.

A. For BigFix Compliance Analytics versions 1.9.x, 1.10.x and 2.0.0:

  1. Make sure that you completed the server and database backup.
  2. In the Security Configuration domain in the console, open the Configuration Management navigation tree.
  3. Under the BigFix Compliance Install/Upgrade menu tree item, select the BigFix Compliance Server 2.0 - Upgrade Fixlet which automatically installs and upgrades to the new version.
  4. Follow the Fixlet instructions and take the associated action to upgrade your BigFix Compliance deployment.
  5. Update the data schema. To do this, log in to the BigFix Compliance web interface from the host server and proceed with configuration. Upgrading the data scheme is expected and it will take some time to complete. NOTE: Automatic upgrade installation only affects installations running under the LocalSystem account. Follow the Fixlet instructions to install the update manually if this fix cannot be applied.

B. For BigFix Compliance Analytics versions prior to 1.9:

  1. Manually upgrade to version 1.10.1.48. The 1.10.1.48 installer can be found here.
  2. After manually upgrading to version 1.10.1.48, use the BigFix Compliance Server 2.0 Upgrade Fixlet to upgrade to version 2.0 (See step A).

More information:

BigFix Compliance team
HCL BigFix

2

I was told that this release would address CVE:CVE-2020-11022,CVE:CVE-2020-11023

“According to the self-reported version in the script, the version of JQuery hosted on the remote web server is greater than or equal to 1.2 and prior to 3.5.0. It is, therefore, affected by multiple cross site scripting vulnerabilities.”

It doesn’t seem to have though, Is there a more detailed release-notes somewhere?

Thanks!

3

We did not update the version of jQuery, however we did apply backports of the security fixes, which should address all of the following vulnerabilities:

  • SNYK-JS-JQUERY-565129
  • SNYK-JS-JQUERY-567880
  • CVE-2020-11022
  • CVE-2020-11023
  • SNYK-JS-JQUERY-174006
  • CVE-2019-11358
  • CVE-2019-5428
2 Likes
4

Hey Karlhe,

Thanks that great to hear, is there a offical document/release notes I can refer too?
Just something I can link to if asked during audit to provide proof this issue was addressed.

Or maybe even get this announcements edited to reference those fixes?

Cheers

1 Like
5

Definitely add any applicable security fixes to all announcements and release notes…

1 Like